diff --git a/cmd/kops/create_cluster.go b/cmd/kops/create_cluster.go
index 68aa126c4e..0b62afbedd 100644
--- a/cmd/kops/create_cluster.go
+++ b/cmd/kops/create_cluster.go
@@ -116,7 +116,11 @@ func (c *CreateClusterCmd) Run(args []string) error {
 	// TODO: Reuse rootCommand stateStore logic?
 
 	if c.OutDir == "" {
-		c.OutDir = "out"
+		if c.Target == cloudup.TargetTerraform {
+			c.OutDir = "out/terraform"
+		} else {
+			c.OutDir = "out"
+		}
 	}
 
 	clusterRegistry, err := rootCommand.ClusterRegistry()
diff --git a/cmd/kops/update_cluster.go b/cmd/kops/update_cluster.go
index d3dce347c9..b1c5cd8630 100644
--- a/cmd/kops/update_cluster.go
+++ b/cmd/kops/update_cluster.go
@@ -67,7 +67,11 @@ func (c *UpdateClusterCmd) Run(args []string) error {
 	}
 
 	if c.OutDir == "" {
-		c.OutDir = "out"
+		if c.Target == cloudup.TargetTerraform {
+			c.OutDir = "out/terraform"
+		} else {
+			c.OutDir = "out"
+		}
 	}
 
 	clusterRegistry, cluster, err := rootCommand.Cluster()
diff --git a/docs/arguments.md b/docs/arguments.md
index bd6e76b4d0..eaaf2d0418 100644
--- a/docs/arguments.md
+++ b/docs/arguments.md
@@ -55,3 +55,7 @@ Values:
 * `external` updates are performed by an external system (or manually), should not be automatically applied
 
 * unset means to use the default policy, which is currently to apply OS security updates unless they require a reboot
+
+## out
+
+`out` determines the directory into which kubectl will write the target output.  It defaults to `out/terraform`
diff --git a/upup/pkg/fi/cloudup/apply_cluster.go b/upup/pkg/fi/cloudup/apply_cluster.go
index 9cb0b8cec9..e7a2477cf5 100644
--- a/upup/pkg/fi/cloudup/apply_cluster.go
+++ b/upup/pkg/fi/cloudup/apply_cluster.go
@@ -467,7 +467,7 @@ func (c *ApplyClusterCmd) Run() error {
 
 	case TargetTerraform:
 		checkExisting = false
-		outDir := path.Join(c.OutDir, "terraform")
+		outDir := c.OutDir
 		target = terraform.NewTerraformTarget(cloud, region, project, outDir)
 
 	case TargetDryRun: